Summary
- Environment: Company systems and employment-related files
- Operational impact: Parts of company systems became inaccessible
- Financial impact: No confirmed incident cost quantified
- Record status: Developing record. Reviewed October 30, 2026; updated as evidence emerges.
What happened
Sarku Japan discovered on September 7, 2026 that parts of its systems were inaccessible because of a cybersecurity incident. The company investigated, secured the affected systems and contained the incident. [1]
Impact
A review completed September 28 found personal information related to employment or engagement in affected files. The public letter leaves the specific categories as a placeholder. It does not quantify the affected population or establish the outage duration. [1]
Timeline
System disruption discovered
Sarku began investigation and containment.
[1]File review completed
The review identified employment-related personal information.
[1]Individual notification letter dated
The letter describes the incident and monitoring offer. The notification sample provides the account.
[1]Briefing updated
This briefing was last reviewed and updated on October 30, 2026.
Threat Group & Attack Vector
The notice does not identify the initial access method, an attacker or ransomware. System unavailability alone does not establish encryption or data theft. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- No specific MITRE ATT&CK technique is currently mapped for this case.
Response
Sarku engaged external cybersecurity and legal specialists, notified law enforcement, enhanced security and offered 12 months of credit monitoring and identity protection. [1]